openssl/apps/include, branch openssl-3.4.0

Copyright year updates

2024-09-05T07:35:49Z

Reviewed-by: Neil Horman Release: yes

Fix typos found by codespell

2024-06-24T13:09:11Z

Reviewed-by: Paul Dale Reviewed-by: Kurt Roeckx (Merged from https://github.com/openssl/openssl/pull/24691)

CMP: add support for genm with crlStatusList and genp with crls

2024-05-01T12:58:35Z

Introduce the capability to retrieve and update Certificate Revocation Lists (CRLs) in the CMP client, as specified in section 4.3.4 of RFC 9483. To request a CRL update, the CMP client can send a genm message with the option -infotype crlStatusList. The server will respond with a genp message containing the updated CRL, using the -infoType id-it-crls. The client can then save the CRL in a specified file using the -crlout parameter. Co-authored-by: Rajeev Ranjan Reviewed-by: Todd Short Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/23768)

apps: ca,req,x509: Add explicit start and end dates options

2024-04-09T18:13:31Z

- Added options `-not_before` (start date) and `-not-after` (end date) for explicit setting of the validity period of a certificate in the apps `ca`, `req` and `x509` - The new options accept time strings or "today" - In app `ca`, use the new options as aliases of the already existing options `-startdate` and `-enddate` - When used in apps `req` and `x509`, the end date must be >= the start date, in app `ca` end date < start date is also accepted - In any case, `-not-after` overrides the `-days` option - Added helper function `check_cert_time_string` to validate given certificate time strings - Use the new helper function in apps `ca`, `req` and `x509` - Moved redundant code for time string checking into `set_cert_times` helper function. - Added tests for explicit start and end dates in apps `req` and `x509` - test: Added auxiliary functions for parsing fields from `-text` formatted output to `tconversion.pl` - CHANGES: Added to new section 3.4 Signed-off-by: Stephan Wurm Reviewed-by: David von Oheimb Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/21716)

Add option `SSL_OP_PREFER_NO_DHE_KEX`, allowing the server to prefer non-dhe psk key exchange over psk with dhe (config file option `PreferNoDHEKEX`, server option `prefer_no_dhe_kex`).

2023-11-24T15:08:04Z

Reviewed-by: Tomas Mraz Reviewed-by: Matt Caswell (Merged from https://github.com/openssl/openssl/pull/22794)

"foo * bar" should be "foo *bar"

2023-09-11T08:15:30Z

Found by running the checkpatch.pl Linux script to enforce coding style. Reviewed-by: Paul Dale Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/21468)

Copyright year updates

2023-09-07T08:59:15Z

Reviewed-by: Richard Levitte Release: yes

CMP: add support for genm with rootCaCert and genp with rootCaKeyUpdate

2023-07-16T22:48:36Z

Reviewed-by: Tomas Mraz Reviewed-by: Paul Dale (Merged from https://github.com/openssl/openssl/pull/21129)

apps/asn1parse: improve RFC7462 compliance

2023-06-09T07:47:34Z

The asn1parse command now supports three different input formats: openssl asn1parse -inform PEM|DER|B64 PEM: base64 encoded data enclosed by PEM markers (RFC7462) DER: der encoded binary data B64: raw base64 encoded data The PEM input format is the default format. It is equivalent to the former `-strictpem` option which is now marked obsolete and kept for backward compatibility only. The B64 is equivalent to the former default input format of the asn1parse command (without `-strictpem`) Fixes #7317 Reviewed-by: Dmitry Belyavskiy Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/7320)

apps/opt: refactor input format parsing

2023-06-09T07:47:34Z

- split OPT_FMT_PEMDER flag into OPT_FMT_PEM and OPT_FMT_DER - add OPT_FMT_B64 option (`-inform b64`) Reviewed-by: Dmitry Belyavskiy Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/7320)